erikandClaude Opus 4.8
10387fdbee
- add sops-nix input + module (jupiter only, not the VM) - secrets/jupiter.yaml: age-encrypted samba_password (safe to commit) - .sops.yaml: encryption rule for admin age key - secrets.nix: decrypt samba_password to /run/secrets on the host - provisioning oneshot reads sops secret (host) or plaintext (VM), single value - .sops private key stays off-repo (~/.config, /var/lib/sops-nix on host) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
17 lines
657 B
Nix
17 lines
657 B
Nix
{ ... }:
|
|
|
|
# sops-nix secret wiring (real host only; not imported by vm.nix).
|
|
# Encrypted values live in ../secrets/jupiter.yaml, decrypted at activation to
|
|
# /run/secrets/<name>. The host needs the age PRIVATE key at the keyFile path.
|
|
#
|
|
# Deploy the private key with the install, e.g. nixos-anywhere:
|
|
# --extra-files, placing your key at /var/lib/sops-nix/key.txt
|
|
# or later derive a host age key from its ssh host key and add it to .sops.yaml.
|
|
{
|
|
sops.defaultSopsFile = ../secrets/jupiter.yaml;
|
|
sops.age.keyFile = "/var/lib/sops-nix/key.txt";
|
|
|
|
# Decrypts to /run/secrets/samba_password (root-only by default).
|
|
sops.secrets.samba_password = { };
|
|
}
|